Threat Hunting in the Cloud

APPENDIX HGlossary

This appendix is a collection of all terms used in the chapters. Note that they are alphabetically ordered so they are easier to find.

A

advanced persistent threat (APT)

An adversary that possesses sophisticated levels of expertise and significant resources, which allow it to create opportunities to achieve its objectives by using multiple attack vectors (e.g., cyber, physical, and deception). This term originated as a way to refer to nation state actors but has become a general term to describe organized adversaries.

adversary 

An individual, group, organization, or government that conducts or has the intent to conduct cybersecurity attacks.

AI (artificial intelligence) 

The simulation of human intelligence in machines that are programmed to think like humans and mimic their actions. The term may also be applied to any machine that exhibits traits associated with a human mind such as learning and problem-solving.

alert 

A notification that a specific attack, anomaly, or suspicious activity has been detected or directed at an organization's information systems. Alerts frequently trigger investigations by security operations/analysts.

analyst 

Also known as a cybersecurity analyst, a common role within an organization's SOC team that investigates, alerts, or hunts for adversarial activities.

asset 

An entity or value that could take the form of a person, structure, facility, information and records, IT systems and resources, material, process, relationships, ...